| Commit message (Collapse) | Author | Files | Lines |
|---|
|
These are macro wrappers around the neutered OBJ_NAME_{add,remove}() API
(notice the consistency), which will be removed shortly. Only security/xca
used to use this.
ok jsing
|
|
Ciphers and digests are now handled in a static lookup table and no
longer by the associative array that used to underlie the OBJ_NAME API.
Adding ciphers is no longer possible. What uses this API does so for
historic reasons coming from a time where SHA-2 and some AES variants
needed to be enabled explicitly. Ports doing this (PHP and DANE code)
were fixed.
ok jsing
|
|
This was deprecated in 0.9.8 and used until recently by rust-openssl
and by keynote (keynote has the excuse that it was written before the
deprecation). Fortunately Paul Kehrer fixed this in rust-openssl,
so we can garbage collect this turd. (It was replaced with the less
ergonomic DSA_generate_parameters_ex() to expose a new fancy way of
displaying dots, stars and pluses on key generation).
ok jsing
|
|
While it is a neat design detail of CMAC that you can resume it after
having finalized it, nothing uses this functionality and it adds some
gross things such as retaining intermediate secrets in the CMAC ctx.
Once this is gone, we can simplify the CMAC code a bit.
ok jsing
|
|
The former could be useful but nothing uses it. The latter is a
dangerous implementation detail of Montgomery exponentiation that
should never have been leaked out of the library. Fix this.
ok jsing
|
|
This function is very slow and useful for testing purposes only. It
should never have been part of the public API. Remove it from there.
ok jsing
|
|
This used to be a dangerous implementation detail of BIO_new() that was
never used outside of libcrypto.
ok jsing
|
|
These were disabled and the internals that need to remain were fixed.
Time for this garbage to go.
ok jsing
|
|
Unsued printing functionality. If something should need this we can readily
add it back.
ok jsing
|
|
Apart from OPENSSL_gmtime(), which is OpenSSL API, this is BoringSSL's
interface to deal with the time related portability and code mess.
ok jsing
|
|
This was a public helper that is no longer used internally either.
ok jsing
|
|
This API was needed since OpenSSL didn't have one. We now have variants
of OpenSSL's API and will also expose BoringSSL's complementary API. The
users of this API were ported to the OpenSSL variants and some may switch
to BoringSSL's in the future. Part of it is still used internally.
ASN1_time_tm_clamp_notafter() is still used by libtls (and only libtls).
This will be fixed in a future bump.
ok jsing
|
|
This is only used by the fuzzing code. Another bit of poorly thought
out extensibility that makes people pass NULL pointers to a bunch
of APIs.
ok jsing
|
|
ok jsing
|
|
The last comsumer, telephony/asterisk, was adjusted a few months back.
pointed out by brad
ok jsing
|
|
The only consumer, a_strnid.c, has its own, slightly more complete, up
to date, and less incorrect, version of these.
ok jsing
|
|
Another remnant of the unused ASN1_STRING_TABLE extensibility goes away.
ok jsing
|
|
This was API for the ASN1_STRING_TABLE extensibility which has been
neutered for months and was completely unused in the ecosystem.
ok jsing
|
|
The ability of modifying the ASN1_STRING_TABLE was removed and the table
is now static. Stop casting away const. The only consumer, security/xca,
is already fixed.
ok jsing
|
|
OK deraadt@ tb@
|
|
These were incorrectly added to asn1.h. OPENSSL_gmtime is in crypto.h
and OPENSSL_timegm is already in posix_time.h
|
|
|
|
|
|
|
|
|
|
|
|
X509_ALGOR_set0_evp_md()
|
|
|
|
|
|
|
|
|
|
ok jsing
|
|
ok jsing
|
|
Avoid conflicts where alignment is specified later in the underlying
assembly.
ok tb@
|
|
Make these functions always fail. A copy of OBJ_bsearch_ex_() is kept
in stack.c, where it is still used by internal_find() for sk_find{,_ex}().
sk_find_ex() will be removed in the upcoming bump, and then we can
simplify or rewrite what's still needed.
ok jsing
|
|
gcm_{gmult,ghash}_4bit(), aesni_ccm64_decrypt_blocks(), aes_cbc_encrypt(),
and aesni_xts_{en,de}crypt() were overlooked in previous passes.
Found with a diff for ld.lld by kettenis
ok kettenis
|
|
cet.h is needed for other platforms to emit the relevant .gnu.properties
sections that are necessary for them to enable IBT. It also avoids issues
with older toolchains on macOS that explode on encountering endbr64.
based on a diff by kettenis
ok beck kettenis
|
|
No cipher in libcrypto is marked EVP_CIPH_CUSTOM_KEY_LENGTH and no control
handler deals with EVP_CTRL_SET_KEY_LENGTH, which means that this code is
dead as far as libcrypto is concerned. Almost nothing uses EVP_CIPHER_meth*
(this was added for a single project) and nothing sets a custom ctrl. This
isn't going to change anyway since EVP_CIPHER_meth* is deprecated in order
to promote more provider beauty.
ok beck jsing
|
|
These don't do anything but return 0 and will be garbage collected in the
upcoming bump.
ok jsing
|
|
|
|
The OpenSSL 1.1 API X509_STORE_get0_objects() is not thread safe. It
exposes a naked internal pointer containing certificates, CRLs and
cached objects added by X509_LOOKUP_hash_dir(). Thus, if the store is
shared between threads, it is not possible to inspect this pointer safely
since another thread could concurrently add to it. This may happen in
particular during certificate verification. This API led to security
issues in rust-openssl and is also problematic in current Python.
Other consumers of X509_STORE_get0_objects() are haproxy, isync, openvpn.
The solution is to take a snapshot of the state under a lock and return
that. This is what X509_STORE_get1_objects() does. It returns a newly
allocated stack that needs to be freed with sk_X509_OBJECT_pop_free(),
passing X509_OBJECT_free as a second argument.
Based on a diff by David Benjamin for BoringSSL.
https://boringssl-review.googlesource.com/c/boringssl/+/65787
ok beck jsing
PS: Variants of this have landed in Python and OpenSSL 3 as well. There the
sk_*deep_copy() API is used, which in OpenSSL relies on evaluating function
pointers after casts (BoringSSL fixed that). Instead of using this macro
insanity and exposing that garbage in public, we can do this by implementing
a pedestrian, static sk_X509_OBJECT_deep_copy() by hand.
|
|
There is now a prototype in x509_internal.h, so no need to repeat that
here.
|
|
requested by/ok jsing
|
|
When this file was brought into KNF, a few things became particularly ugly.
This makes {a,b}{,_{min,max}} have function scope in canonize/is_canonical,
which removes unfortunate line wraps and some other silliness.
ok job
|
|
|
|
|
|
|
|
|
|
This exercises the new API, in particular with respect to overflow behavior
around the years 0/9999, which are special for GeneralizedTime/X.509.
|
|
Document OPENSSL_{posix_to_tm,tm_to_posix}() and fix the documentation of
OPENSSL_{gmtime,timegm}().
ok jsing
|
